Jupyter Server Gateway Bypass Allows Unauthorized Kernel Execution

Jupyter Server versions between 2.0.0 and 2.5.0 contain a high-severity authorisation bypass in their gateway mode. This flaw allows authenticated users who lack execute permissions to run code on upstream kernels, potentially exposing sensitive data or disrupting the environment.

What happened

The issue stems from how Jupyter Server handles WebSocket connections when the gateway feature is active. According to GitHub advisory GHSA-354v-3q48-cv69, enabling GatewayClient.url replaced the standard KernelWebsocketHandler with WebSocketChannelsHandler. While this gateway handler verified that a user was authenticated, it failed to call the configured authoriser to check if the user had permission to execute actions on the kernels resource. Consequently, a restricted user could open an upstream kernel channel and send messages, effectively bypassing the security controls intended to deny them access.

Why it matters

This vulnerability is rated high with a CVSS score of 8.8 by the National Vulnerability Database. It maps to CWE-862, indicating a missing authorisation for critical functionality. Security teams must recognise that even if a user cannot normally execute kernels, the gateway configuration in these older versions creates a path for unauthorised code execution. This exposes any credentials or data accessible to the kernel, allowing for potential data theft or environmental disruption by any authenticated user within the system.

Next steps

• Verify if your deployment uses Jupyter Server versions 2.0.0 through 2.5.0 with gateway mode enabled.
• Upgrade to version 2.6.0 or later to apply the fix for the default gateway configuration.
• Audit custom configurations to ensure the deprecated jupyter_server.gateway.handlers module is not manually registered, as this reintroduces the bypass.
• Review access logs for any unexpected kernel connections from users who should not have execution privileges.

Detection notes

Teams usually monitor WebSocket connection attempts and kernel lifecycle events for anomalies. Check whether authenticated users who lack execute permissions are initiating kernel channels or sending execution messages. Look for discrepancies where a user is logged as authorised for access but not for execution, yet kernel activity occurs. Containment moves typically involve isolating affected kernels and reviewing the specific handler configurations to ensure the deprecated module is not active in the current deployment.

What to do and how to stay safe: Jupyter Server

• Audit your Jupyter Server installations to confirm they are running version 2.6.0 or later.
• Inspect configuration files to ensure the deprecated gateway handler module is not manually loaded.
• Monitor access logs for kernel execution attempts by users who should be restricted from such actions.
• Once the vendor provides an update for any future regressions, apply it promptly to maintain security posture.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Jupyter Server are affected by this authorisation bypass?

Versions 2.0.0 through 2.5.0 are affected when GatewayClient.url is enabled, while version 2.6.0 fixes the default configuration but retains risk if the deprecated handler is manually registered.

What is the CVSS score for CVE-2026-114135?

The National Vulnerability Database rates this vulnerability as high with a CVSS score of 8.8.

Does upgrading to version 2.6.0 completely eliminate the risk?

Version 2.6.0 fixes the default gateway configuration, but the risk remains if a deployment manually registers the deprecated jupyter_server.gateway.handlers module.